CVE-2026-14406: Chrome V8 Out-of-Bounds Read via Malicious Extension

Technical summary

CVE-2026-14406 is an out-of-bounds read vulnerability in the V8 JavaScript engine embedded in Google Chrome. The flaw exists in versions prior to 150.0.7871.46. The attack vector involves a crafted Chrome Extension that, when installed, can trigger the out-of-bounds read to access adjacent memory regions. The vulnerability is rooted in improper bounds checking (CWE-125) during memory access operations within V8. The attack requires network access but no special privileges or user interaction beyond extension installation. The confidentiality impact is rated high, while integrity and availability are not affected.

Business impact

For organizations that do not actively manage Chrome extension policies, this vulnerability poses a data exfiltration risk. An attacker could target employees with spear-phishing campaigns or watering-hole attacks promoting a seemingly legitimate extension, then silently harvest sensitive data from browser memory—such as session tokens, API keys, or cached credentials. The threat is amplified in environments where users have administrative privileges to install extensions without IT oversight. However, the requirement for prior extension installation provides a control point; organizations enforcing extension allow-lists can significantly reduce exposure.

Affected systems

Google Chrome versions prior to 150.0.7871.46 are affected. This includes all stable, beta, and development channel releases below that version number. Users of Chromium-based browsers that bundle the affected V8 version may also be at risk; verify the version of V8 included in any Chromium derivatives in your environment. The vulnerability does not affect other browser engines or non-Chrome products.

Exploitability

Exploitability is moderate. The vulnerability requires an attacker to convince a user to install a malicious extension, which involves social engineering. Once the extension is installed, however, the exploitation step itself does not require additional user interaction—the crafted extension can trigger the memory read automatically. There are no known public exploits in the wild at this time, and the vulnerability is not tracked on the CISA KEV catalog, suggesting limited in-the-wild abuse as of the publication date. Threat actors with access to distribution channels (compromised extension stores, phishing campaigns) pose the highest risk.

Remediation

Update Google Chrome to version 150.0.7871.46 or later. In parallel, audit installed extensions for legitimacy and remove any that are unrecognized or unused. For enterprise environments, deploy extension allow-list policies via Google Admin Console (for Chromebooks and managed Chrome installations) or third-party MDM solutions to restrict installation to pre-approved extensions only. Consider using extension monitoring tools to detect suspicious extension behavior.

Patch guidance

Google has released Chrome 150.0.7871.46 with a fix for this vulnerability. Patches are auto-deployed on Chrome's stable channel for most users, but verify your installed version by navigating to chrome://settings/help. The update will automatically restart Chrome and apply the patch. For enterprise deployments, confirm rollout via your Chrome Management Console. No manual compilation or custom patching is required for standard Chrome installations.

Detection guidance

Monitor for unusual extension installations, particularly those from unsigned or recently created developer accounts. Use Chrome's native Safe Browsing feature, which flags malicious extensions. In enterprise environments, log extension installation events via Chrome Management console and look for extensions with suspicious permissions (e.g., 'read all your data', 'modify pages'). Memory forensics tools applied to running Chrome processes may reveal signs of out-of-bounds access attempts, though this is difficult to detect in real time. Endpoint detection and response (EDR) solutions that monitor process memory access patterns can be configured to flag abnormal V8 engine behavior.

Why prioritize this

Assign this a medium-to-high priority for enterprises with loose extension policies or high-value targets (financial, legal, healthcare sectors). Organizations with strict extension allow-lists and user training should prioritize it as routine maintenance. The CVSS score of 5.9 reflects the social-engineering barrier, but the confidentiality impact and memory-disclosure nature make it serious for data-sensitive environments. Patch within 30 days for standard deployments; prioritize within 7–14 days if your organization has sensitive data accessible from browser memory (e.g., API credentials, PII).

Risk score, explained

The CVSS 3.1 score of 5.9 (Medium) is driven by a high confidentiality impact (C:H) but zero integrity and availability impact. The attack vector is network (AV:N) and requires high complexity (AC:H) due to the need to socially engineer extension installation. The vulnerability awards no privilege escalation or user interaction during exploitation itself (UI:N, PR:N), once the extension is present. The confined scope (S:U) and lack of cascading effects justify the medium rating, but organizations handling sensitive data should treat this as operationally significant.

Frequently asked questions